skills.rest
jaeyeom
jaeyeomCOMMUNITY
Explore all skills by this author →
GitHub

semgrep-review

Triage semgrep findings using data-flow and sanitization checks.

1|Updated Jan 24, 2026
Search Tags:#vulnerability#static-analysis#triage#code-review#semgrep#escaping#nosemgrep
One-click install
npx skills add https://github.com/jaeyeom/claude-toolbox --skill semgrep-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-review
Source: https://github.com/jaeyeom/claude-toolbox/tree/main/plugins/semgrep-review/skills/semgrep-review
Command: npx skills add https://github.com/jaeyeom/claude-toolbox --skill semgrep-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes semgrep scan findings to distinguish real vulnerabilities from false positives and prepares targeted fixes with safe coding practices.

Core Features & Use Cases

  • Triage each finding by examining source, data flow, and sanitization to determine risk.
  • Propose framework-native escaping and minimal, well-documented nosemgrep suppressions.
  • Integrate with CI workflows to automate verification and documentation of fixes.
  • Use case: In a codebase with semgrep results, triage findings, apply safe fixes, and annotate false positives for future review.

Quick Start

Scan your repository with semgrep, triage findings, and apply suggested fixes.

Frequently Asked Questions about semgrep-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage semgrep findings to distinguish real vulnerabilities from false positives?▼

You can triage semgrep findings by analyzing source data flow and sanitization checks to determine risk, separating real vulnerabilities from false positives to prioritize code review efforts.

What is the best way to suppress false positives in semgrep without hiding real issues?▼

The best way to suppress false positives in semgrep is applying minimal, well-documented nosemgrep annotations, ensuring only verified non-issues are excluded from future static-analysis scans.

How do I fix static-analysis vulnerabilities using framework-native escaping?▼

Fix static-analysis vulnerabilities by applying framework-native escaping techniques to sanitize data flows, generating targeted fixes that leverage built-in security features for safe coding practices.

Can I integrate semgrep triage into CI pipelines for automated vulnerability verification?▼

Yes, you can integrate semgrep triage into CI pipelines to automate vulnerability verification and documentation, ensuring targeted fixes are validated continuously during the software development lifecycle.

Why does semgrep report vulnerabilities that do not seem to affect my codebase?▼

Semgrep reports these because static-analysis often flags potential data-flow paths without verifying runtime sanitization, requiring manual triage to confirm whether the vulnerability is a false positive.

When should I use nosemgrep suppressions during code review?▼

Use nosemgrep suppressions during code review when data-flow analysis confirms a finding is a verified false positive, ensuring the annotation is precise and does not mask actual vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
mcnclmcncl

build-triggering

Trigger Buildkite builds with branch, commit, and explicit confirmation.

Community
Advanced
LuisSambranoLuisSambrano
7

code-review

Perform systematic code review and static analysis across multiple programming languages.

Community
Advanced
cdalsoniiicdalsoniii

SAST Triage

Triage gosec, golangci-lint, and govulncheck findings by severity and false positives.

Community
Intermediate